Abstract: Manufacturing operational technology (OT) networks require detection methods that improve adversary visibility without disrupting physical processes. Deception technologies can generate high-confidence alerts because legitimate users should not interact with decoy workstations, historian tags, honeytokens, or simulated industrial services. However, organizations often struggle to determine whether deception deployments are effective after pilot installation.